KR20210049603A - Method and apparatus for performing access control using role based certification - Google Patents

Abstract

The present invention relates to a method for authenticating an electronic device and performing security ranging for access control which comprises the following steps of: receiving a device certificate including a first STS code encrypted by a public key of the electronic device and a second STS code encrypted by an STS key from a server; transmitting the device certificate to a target device; obtaining the first STS code by decrypting the encrypted first STS code using a private key of the electronic device; and performing secure ranging with the target device using the first STS code.

Description

Method and apparatus for controlling access using certificates based on rights information {METHOD AND APPARATUS FOR PERFORMING ACCESS CONTROL USING ROLE BASED CERTIFICATION}

The present disclosure relates to a method for authenticating an electronic device and an apparatus therefor, and more particularly, to a method and apparatus for authenticating an electronic device and performing security ranging by using a certificate based on authority information.

As personalized electronic devices such as smart phones and tablet PCs are popular, technologies for performing security and authentication using a digitized virtual key, that is, a digital key, are being developed. As a method of such digital key technology, a technology in which a digital key is integrated into an electronic device, for example, a smart phone using wireless communication technology, has been developed.

By inserting the digital key into the electronic device, the user of the electronic device can open and close the door using a digital key that replaces the physical key. In addition, as the function of the digital key is further expanded, a user of an electronic device can use the digital key for access to and control of the device.

While the use of digital keys can bring great improvements in user convenience and industrial effectiveness, concerns about security have also been raised. Due to the nature of a digital key that needs to be combined with an electronic device, it may be exposed to risks such as hacking into an electronic device. Therefore, it is necessary to process the digital key in an area with high security level.

In addition, in the field of a physical access control system, there is a need for a method of performing security ranging by immediately generating a digital key while maintaining the above-described security level.

The present disclosure is to provide a method for authenticating an electronic device and an apparatus accordingly.

A method of operating an electronic device according to an embodiment of the present disclosure includes a first STS (Scrambled Timestamp Sequence) code encrypted by a public key of the electronic device and a second STS code encrypted by a key of a target device. Receiving a device certificate from a server; Transmitting the device certificate to the target device; Decrypting the encrypted first STS code using the private key of the electronic device to obtain a first STS code; And performing security ranging with the target device by using the first STS code.

A method of operating a target device according to an embodiment of the present disclosure includes a device certificate including a second STS (Scrambled Timestamp Sequence) code encrypted by an STS key and a first STS code encrypted by a public key of the electronic device. Receiving from the electronic device; Decrypting the encrypted second STS code using the STS key to obtain a second STS code; And performing security ranging with the electronic device by using the second STS code.

A method of operating a server according to an embodiment of the present disclosure includes: receiving a certificate signing request (CSR) including authorization information of an electronic device for a target device from the electronic device; Checking the certificate signing request and policy information related to the authority of the electronic device; Generating a device certificate including a first STS code encrypted by the public key of the electronic device and a second STS code encrypted by the STS key based on the verification result; And transmitting the device certificate to the electronic device.

An electronic device according to an embodiment of the present disclosure includes: a communication unit communicating with a server and a target device; A memory for storing at least one or more instructions; And at least one processor that controls the electronic device by executing the at least one instruction. The at least one processor receives a device certificate from a server including a first STS code encrypted by the public key of the electronic device and a second STS code encrypted by the STS key, and the device certificate Is transmitted to the target device, and the encrypted first STS code is decrypted using the private key of the electronic device to obtain a first STS code, and the target device and the security lane using the first STS code Gong can be practiced.

A target device according to an embodiment of the present disclosure includes: a communication unit communicating with an electronic device; A memory for storing at least one or more instructions; And at least one processor controlling the target device by executing the at least one instruction. The at least one processor receives from the electronic device a device certificate including a second STS code encrypted by an STS key and a first STS code encrypted by a public key of the electronic device, and uses the STS key. , The encrypted second STS code may be decrypted to obtain a second STS code, and security ranging with the electronic device may be performed using the second STS code.

1 is a schematic diagram of a system for authenticating an electronic device according to an embodiment of the present disclosure.
2 is a schematic diagram illustrating a connection between devices for authenticating an electronic device according to an embodiment of the present disclosure.
3 is a flowchart illustrating a method of operating an electronic device according to an embodiment of the present disclosure.
4 is a device certificate based on authority information according to an embodiment of the present disclosure.
5 is a flowchart illustrating a method of operating a target device according to an embodiment of the present disclosure.
6 is a flowchart illustrating a method of operating a server according to an embodiment of the present disclosure.
7 is a diagram illustrating a method of transmitting and receiving data between devices according to an embodiment of the present disclosure.
8 is a flowchart illustrating a method of transmitting and receiving data between an electronic device and a server according to a process of generating and transmitting a device certificate according to an embodiment of the present disclosure.
9 is a flowchart illustrating a method of transmitting and receiving data between an electronic device and a target device in order to perform access control according to an embodiment of the present disclosure.
10 corresponds to a diagram showing an embodiment when using a mobile application according to an embodiment of the present disclosure.
FIG. 11 corresponds to a diagram showing an embodiment when using a kiosk according to an embodiment of the present disclosure.
12 corresponds to an example of application to an entrance door of a ski lift according to an embodiment of the present disclosure.
13 is a block diagram illustrating an internal configuration of a target device according to an embodiment of the present disclosure.
14 is a block diagram illustrating an internal configuration of an electronic device according to an embodiment of the present disclosure.
15 is a block diagram illustrating an internal configuration of a server according to an embodiment of the present disclosure.

Hereinafter, embodiments of the present disclosure will be described in detail with reference to the accompanying drawings so that those of ordinary skill in the art may easily implement the present disclosure. However, the present disclosure may be implemented in various different forms and is not limited to the embodiments described herein. In addition, parts irrelevant to the description are omitted in the drawings in order to clearly describe the present disclosure, and similar reference numerals are attached to similar parts throughout the specification.

Some embodiments of the present disclosure may be represented by functional block configurations and various processing steps. Some or all of these functional blocks may be implemented with various numbers of hardware and/or software components that perform specific functions. For example, the functional blocks of the present disclosure may be implemented by one or more microprocessors, or may be implemented by circuit configurations for a predetermined function. In addition, for example, the functional blocks of the present disclosure may be implemented in various programming or scripting languages. Functional blocks may be implemented as an algorithm executed on one or more processors. In addition, the present disclosure may employ conventional techniques for electronic environment setting, signal processing, and/or data processing.

Further, the connecting lines or connecting members between the components shown in the drawings are merely illustrative of functional connections and/or physical or circuit connections. In an actual device, connections between components may be represented by various functional connections, physical connections, or circuit connections that can be replaced or added.

Hereinafter, the present disclosure will be described in detail with reference to the accompanying drawings.

Throughout the specification, the STS key, the public key of the electronic device, and the private key are unique keys of each device given to each device, and may be used to encrypt or decrypt data.

1 is a schematic diagram of a system for authenticating an electronic device according to an embodiment of the present disclosure.

Referring to FIG. 1, a system for authenticating an electronic device may include a target device 100, an electronic device 200, and a server 300.

The target device 100 may be provided at a gate such as a car, a hotel, a house, a building, an amusement park, or a ski resort. More specifically, the target device 100 is provided in a door 10 such as a vehicle door, a trunk gate, and an access gate for starting and controlling the vehicle, as well as a vehicle door, a trunk gate, and a gas inlet, and can control whether the door 10 is opened or closed have. In addition, the present invention is not limited thereto, and the target device 100 may be provided on a door 10 such as a gate in a lift gate of a ski resort to control whether the door 10 is opened or closed. For example, the target device 100 may be a digital door lock that controls whether or not the door 10 is opened or closed. The type of the target device 100 that can control whether to open or close using a digital key is not limited to the example shown in FIG. 1.

The target device 100 may perform short-range wireless communication with the electronic device 200. Specifically, short-range communication technology according to an embodiment of the present disclosure includes wireless LAN, Wi-Fi, Bluetooth, zigbee, Wi-Fi Direct (WFD), ultra wideband (UWB), Infrared communication (IrDA, infrared data association), BLE (Bluetooth Low Energy), NFC (Near Field Communication), etc. may be, but is not limited thereto.

The electronic device 200 according to the exemplary embodiment of the present disclosure may be implemented in various forms. For example, the electronic device 200 includes a smart TV, a set-top box, a mobile phone, a tablet PC, a digital camera, a laptop computer, a desktop, an e-book terminal, a digital broadcasting terminal, personal digital assistants (PDAs), and PMPs. (Portable Multimedia Player), navigation, MP3 player, wearable device, and the like. However, the electronic device 200 is not limited to the above-described example, and any device capable of communicating with the server 300 through a network and communicating with the target device 100 through short-range wireless communication may be used. . For example, the electronic device 200 may be any device capable of transmitting and receiving data for authenticating the electronic device 200 to the server 300 through a network.

A communication method of a network according to an embodiment of the present disclosure is not limited, and a communication method using a communication network (for example, a mobile communication network, a wired Internet, a wireless Internet, a broadcasting network) that may be included in the network may be included. For example, the network is a personal area network (PAN), a local area network (LAN), a campus area network (CAN), a metropolitan area network (MAN), a wide area network (WAN), a broadband network (BBN), and the Internet. It may include any one or more of the networks. The network may include any one or more of network topologies including a bus network, a star network, a ring network, a mesh network, a star-bus network, a tree, or a hierarchical network, but is not limited thereto.

The server 300 communicates with the electronic device 200 through a network, and may be implemented as at least one computer device. The server 300 may be distributed in a cloud form, and may provide commands, codes, files, data, and the like.

2 is a schematic diagram illustrating a connection between devices for authenticating an electronic device according to an embodiment of the present disclosure.

Each of the components shown in FIG. 2 is indicated by a solid line when there is a direct connection between the components and a dotted line when the components are connected by communication. For example, the target device 100 may be directly attached or provided on the door 10. However, the present invention is not limited thereto, and the target device 100 may be connected to the door 10 through communication. Also, the target device 100 may be connected to the electronic device 200 through short-range communication, and the electronic device 200 may be connected to the server 300 through a network. In this case, since the target device 100 is capable of short-range communication only, it cannot perform direct communication with the server 300.

Hereinafter, a method of operating the target device 100, the electronic device 200, and the server 300 will be described in detail with reference to FIGS. 3 to 15.

3 is a flowchart illustrating a method of operating an electronic device according to an embodiment of the present disclosure.

In operation S310, the electronic device 200 may receive a device certificate from the server 300.

First, the device certificate according to an embodiment of the present disclosure may correspond to a certificate based on authority information, and more specifically, may correspond to the device certificate 400 of FIG. 4. According to FIG. 4, the device certificate 400 may include an encrypted first STS (Scrambled Timestamp Sequence) code 430 and an encrypted second STS code 440.

In this case, according to an embodiment of the present disclosure, the first STS code and the second STS code may correspond to the same STS code. In addition, the encrypted first STS code and the encrypted second STS code may mean an STS code encrypted using two different keys for the same STS code. At this time, according to an embodiment of the present disclosure, one STS code may be encrypted using an STS key, and the other STS code may be encrypted using a device key.

In more detail, in the present disclosure, the first STS code may correspond to a code that is encrypted using a public key of the electronic device 200. In addition, the encrypted first STS code may mean a code that is decrypted using a secret key of the electronic device 200.

In addition, in the present disclosure, the second STS code may correspond to a code that is encrypted using an STS key. In addition, the encrypted second STS code may mean a code that is decrypted using an STS key.

At this time, in the present disclosure, the STS key refers to a key used when encrypting and decrypting STS (Scrambled Timestamp Sequence) codes, and according to FIG. 7 to be described later, the key issued from the PKI root 700 May be applicable. A detailed description of the STS key is performed in FIG. 7 below.

According to the above-described embodiment, the device certificate 400 may include the first STS code 430 encrypted by the public key of the electronic device 200 and the second STS code 440 encrypted by the STS key. have.

In addition, the device certificate 400 may further include at least one of authorization information 410 related to device authorization authenticated through the device certificate 400 and period information 420 for a period in which the device certificate is valid.

In this case, the authorization information related to the device authorization authenticated through the device certificate may correspond to authorization information for accessing the target device 100 or controlling the target device 100.

In this case, the period information may correspond to information on a period in which the generated corresponding device certificate is valid.

According to an embodiment of the present disclosure, the device certificate 400 is signed by the server 300 through an authentication process based on at least one of information about a user's payment information, a certificate signing request (CSR), and policy information. 450).

In this case, the policy information in the present disclosure may correspond to policy information related to the authority of the electronic device 200, and the like. In more detail, the policy information is information on a policy related to the authority of the electronic device 200, policy information related to a service to be provided to the electronic device 200, service information according to the authority of the electronic device 200, and the electronic device. The access policy for the target device 100 based on information on the period in which the service is provided for 200, the period in which the service is provided for the electronic device 200 and amount information according to the authority, and the authority information of the electronic device 200 It may correspond to information including all information, such as an internal access policy.

According to an embodiment of the present disclosure, the receiving of the device certificate includes a certificate signing request (CSR, Certificate Signing Request) including authorization information of the electronic device 200 for the target device 100 based on a user input. ) To the server 300 and receiving a device certificate from the server 300 in response to the certificate signing request. In more detail, the user may input access request information. In a non-limiting embodiment, the access request information may include at least one or more of authority information and period information.

In this case, the authorization information input by the user may correspond to a service to be obtained through payment or the like. In addition, the authorization information may correspond to a service that can be obtained through the electronic device 200.

As a non-limiting example, when the target device 100 is a door of a gymnasium, the authorization information may correspond to information on whether the electronic device 200 of a user using the gym service can open the door. have. That is, the user may input a'one month gym pass' in order to use the service. The electronic device 200 may transmit a certificate signing request for the'one month gym use right' to the target device 100 to the server.

In addition, the authority information may be subdivided by class according to the policy information, and each authority information may be categorized into a premier level, a VIP level, a general level, etc. according to a service provided. For example, when a user wants to receive a service for a single space operated by a rating system, the user may select a rating for a desired service. Accordingly, when the user selects a premium level for the above-described service, the user may input'premium level' as the authority information, and may select a maintenance period of the selected authority information and input period information. In the present disclosure, the authorization information 410 and the period information 420 included in the device certificate 400 may correspond to information generated based on the authorization information and period information of the access request information input by the user. . In more detail, the authorization information 410 and the period information 420 of the device certificate 400 are based on certificate signing request (CSR) information, policy information related to the authorization of the electronic device, payment information of the user, etc. Thus, it may correspond to information generated when the electronic device 200 is authenticated. In addition, the authorization information 410 and the period information 420 may correspond to information generated based on the authorization information and period information of the access request information input by the user.

According to an embodiment of the present disclosure, a user may input authority information and period information in an application or kiosk running on a mobile device, and the corresponding embodiment will be described in more detail with reference to FIGS. 8 and 10 to 11. do.

In operation S320, the electronic device 200 may transmit the device certificate 400 to the target device 100. In this case, according to an embodiment of the present disclosure, the device certificate 400 may be transmitted in the form of a device certificate chain.

In operation S330, the electronic device 200 may obtain the first STS code by decrypting the encrypted first STS code using the private key of the electronic device 200.

In step S340, the electronic device 200 may perform security ranging with the target device 100 using the first STS code. According to an embodiment of the present disclosure, the electronic device 200 may perform security ranging using the target device 100 and an ultra-wideband (UWB).

In the present disclosure, security ranging means determining the distance between the electronic device 200 and the target device 100, and performing authentication of the target device 100 with respect to the electronic device 200, so that the target device 100 It can mean a controlled process. In FIG. 5, a detailed operation of security ranging will be described later.

5 is a flowchart illustrating a method of operating a target device according to an embodiment of the present disclosure.

In step S510, the target device 100 includes a second STS (Scrambled Timestamp Sequence) code 440 encrypted by the STS key and a first STS code 430 encrypted by the public key of the electronic device 200 The device certificate 400 may be received from the electronic device 200.

According to an embodiment of the present disclosure, the device certificate 400 may further include at least one of authorization information 410 related to device authorization authenticated through the device certificate and period information 420 for a period in which the device certificate is valid. I can.

According to an embodiment of the present disclosure, the target device 100 authenticates the device certificate 400, and the target device 100 authenticates the device authority-related authority information based on the device certificate 400 At least one of 410 and period information 420 may be detected. In this case, the target device 100 may match at least one of the detected period information 420 and the detected authority information 410 with policy information related to the authority of the electronic device.

In step S520, the target device 100 may obtain the second STS code by decrypting the encrypted second STS code using the STS key.

In step S530, the target device 100 may perform security ranging with the electronic device 200 using the second STS code. In this case, as a non-limiting embodiment, the target device 100 may be a device that controls an entrance door.

According to an embodiment of the present disclosure, performing security ranging may include determining a distance using UWB and determining whether to open or close an entrance door based on the determined distance. In this case, determining whether to open or close the door may include determining to open the door when the determined distance is less than a preset distance and the first STS code and the second STS code are the same. .

In more detail, the target device 100 may determine a distance to the electronic device 200 using UWB. In this case, as a non-limiting embodiment, the distance may be determined based on a general ranging technique using UWB. When the determined distance to the electronic device 200 is less than a preset distance, the target device 100 may determine whether the first STS code and the second STS code match. At this time, in the present disclosure, the STS code may be used to prevent ED (Early Detection) and LC (Late Commit) attacks.

6 is a flowchart illustrating a method of operating a server according to an embodiment of the present disclosure.

In step S610, the server 300 may receive a certificate signing request (CSR) including authorization information of the electronic device 200 for the target device 100 from the electronic device 200. In more detail, in this step, the server 300 may receive a certificate signing request (CSR) and a device public key from the electronic device 200.

In step S620, the server 300 may check information on the certificate signing request (CSR) and policy information related to the authority of the electronic device. In more detail, in this step, the server 300 may check information on a certificate signing request (CSR), payment information, and policy information related to authority of the electronic device.

In step S630, based on the confirmation result, the server 300 is a device including a first STS code 430 encrypted by the public key of the electronic device and a second STS code 440 encrypted by the STS key Certificate 400 can be generated.

In this case, according to an embodiment of the present disclosure, the server 300 may generate a first STS code and a second STS code based on the confirmation result.

In addition, the device certificate 400 may further include authorization information 410 related to device authorization authenticated through the device certificate and period information 420 for a period in which the device certificate is valid.

In step S640, the server 300 may transmit the device certificate 400 to the electronic device 200. In this case, according to an embodiment of the present disclosure, the device certificate may be transmitted in the form of a device certificate chain for the device certificate.

A method of transmitting and receiving data between the server 300 and the electronic device 200 will be described in more detail with reference to FIG. 8.

7 is a diagram illustrating a method of transmitting and receiving data between devices according to an embodiment of the present disclosure.

In more detail, FIG. 7 corresponds to a flowchart of a method of transmitting and receiving data between devices during initial setup of a system according to an embodiment of the present disclosure. That is, the data transmission and reception of FIG. 7 may be performed before the operations of FIGS. 3 to 6 of the present disclosure are performed. According to FIG. 7, information may be initially set for the target device 100, the electronic device 200, and the server 300.

First, the PKI root 700 may mean a server of a certification authority that issues and transmits certificates of certification authorities to devices and servers to be authenticated in a public key infrastructure (PKI). In the present disclosure, the certification authority may mean an agency or a server of an agency that provides a service for issuing and managing digital certificates for electronic signature and encryption. In this case, according to an embodiment of the present disclosure, the PKI root 700 may correspond to a server of a certification authority corresponding to a root certification authority (root CA) or a sub-root certification authority (Sub Root CA). In addition, the PKI root 700 may play a role of issuing a STS (Scrambled Timestamp Sequence) key to a device to be authenticated.

According to an embodiment of the present disclosure, the target device 100 may receive a certificate of a root certification authority (Root CA) from the PKI root 700. In this case, the certificate of the highest certification authority may include the public key of the highest certification authority.

In this case, the certificate of the top-level certification authority (Root CA) may correspond to a self-signed top-level certificate that forms the basis of a public key infrastructure (PKI) based on X.509 in general. The certificate of the root CA can be trusted by all PKI-based entities.

According to an embodiment of the present disclosure, the target device 100 may receive a STS (Scrambled Timestamp Sequence) key 710 from the PKI root 700.

According to an embodiment of the present disclosure, the electronic device 200 may receive a certificate of a root certification authority (root CA) from the PKI root 700. In this case, the certificate of the highest certification authority may include a public key of the highest certification authority.

According to an embodiment of the present disclosure, the server 300 may receive a certificate of a sub-root CA from the PKI root 700.

At this time, the certificate of the sub-root CA is signed with the certificate of the top-level certification authority (Root CA), but if an extended key is used, it may mean a certificate that can sign other certificates (end entity or leaf certificate). . The certificate of this sub-certification authority (Sub Root CA) can play a role of protecting the PKI-based system system from errors caused by exposing the private key. In addition, a certificate of a sub-root CA may correspond to a certificate signed by a private key of a top-level certification authority.

According to an embodiment of the present disclosure, like the target device 100, the server 300 may receive the STS key 720 from the PKI root 700.

According to an embodiment of the present disclosure, all STS keys may be the same and may have symmetry. That is, the STS key 710 and the STS key 720 of the present disclosure are the same and may correspond to keys having symmetric properties. In addition, the STS key may be used to encrypt and decrypt the STS code, and in this case, a symmetric algorithm may be used. In this case, the symmetric algorithm may include AES-256, but is not limited thereto.

That is, according to an embodiment of the present disclosure, the second STS code is encrypted using the STS key 720, and the encrypted second STS code is decrypted using the STS key 710. The STS key 710 and the STS key 720 are the same and may correspond to keys having symmetric properties.

8 is a flowchart illustrating a method of transmitting and receiving data between an electronic device and a server according to a process of generating and transmitting a device certificate according to an embodiment of the present disclosure.

In more detail, FIG. 8 may correspond to a diagram of a method in which the server 300 generates a device certificate 400 and a process in which the electronic device 200 receives the device certificate 400 from the server 300. . Accordingly, FIG. 8 may correspond to a diagram explaining in more detail the above-described step S310 of FIG. 3 and the flowchart of FIG. 6.

First, in step S810, the electronic device 200 may receive access request information from a user. That is, the electronic device 200 may receive access request information including at least one of authorization information and period information from the user. At this time, as an example, the access request information is information of'the right to open the gym door' and'valid for 3 months' for the'service using the gym' It may include.

In this case, as a non-limiting example of the present disclosure, the user may input access request information using an application or kiosk running on a mobile device, and the electronic device 200 may receive the access request information input by the user. . The above-described embodiment is described in more detail in FIGS. 10 to 11.

In operation S820, the electronic device 200 may generate a device secret key 810 and a device public key 820 based on the received access request information. As another example of the present disclosure, the device private key 810 and the device public key 820 may be reused in various certificates, and may not be regenerated each time access request information is received.

In step S830, the electronic device 200 may generate a certificate signing request (CSR) based on the authorization information. In more detail, the electronic device 200 may generate a certificate signing request (CSR) based on at least one of authorization information and period information included in the received access request information. At this time, as an example, the certificate signing request (CSR) for the access request information for the above-described'service using the gym' may be generated including a period of 3 months and the right to open the gym door.

In step S840, the electronic device 200 may transmit a certificate signing request (CSR) and a device public key 820 to the server 300. This step may correspond to a step corresponding to S610. In addition, in step S850, the server 300 may receive payment information. In this case, the order of steps S840 and S850 may be changed, and according to another embodiment of the present disclosure, after the server 300 receives payment information (S850), the electronic device 200 requests a certificate signing ( CSR) and the device public key 820 may be transmitted to the server 300.

In the present disclosure, the payment information may correspond to information generated when a user inputs authorization information for a service and an amount corresponding to period information for maintaining the authorization. In this case, the payment amount may be determined based on policy information according to an embodiment of the present disclosure.

In step S860, the server 300 may generate a first STS code and a second STS code by checking information on a certificate signing request (CSR), payment information, and policy information related to the authority of the electronic device. This step may correspond to a step corresponding to S620.

And in step S870, the server 300 is the authorization information 410 related to the device authorization authenticated through the device certificate, period information 420 about the period in which the device certificate is valid, the encrypted first STS code 430 and encryption The device certificate 400 may be generated by including at least one or more of the second STS codes 440. This step may be a step corresponding to S630 of FIG. 6.

In this case, according to an embodiment of the present disclosure, the encrypted first STS code may mean a code encrypted with the first STS code with the public key 820 of the electronic device. In addition, the encrypted second STS code may mean a code encrypted by the STS key 720.

In step S880, the server 300 may transmit the generated device certificate. This step may be a step corresponding to S640 of FIG. 6. According to an embodiment of the present disclosure, the device certificate 400 may be transmitted in the form of a device certificate chain for a device certificate. At this time, as an example, in the device certificate chain, the device public key is signed by the private key of the server 300, and the public key of the server 300 is the target device 100 ) Can be created by being signed by the private key.

Then, in step S890, the electronic device 200 may check the received device certificate chain.

9 is a flowchart illustrating a method of transmitting and receiving data between an electronic device and a target device in order to perform access control according to an embodiment of the present disclosure.

In more detail, FIG. 9 may correspond to steps S320 to S340 of the electronic device 200 in FIG. 3, and FIG. 9 may correspond to steps S510 to S530 of the target device 100 in FIG. 5.

First, in step S910, the target device 100 may transmit the generated nonce to the electronic device 200.

Then, in step S920, the electronic device 200 may transmit the device certificate 400 to the target device 100. In more detail, the electronic device 200 may transmit a device certificate chain and transmit a nonce signed with a device secret key 810. In this case, according to an embodiment of the present disclosure, the electronic device 200 may transmit the device certificate chain and the nonce signed with the device private key 810 using Bluetooth, but is not limited thereto, and all OOB (Out- Of-Band) channel can be used for data transmission.

In step S930, the target device 100 may authenticate the device certificate chain. Then, in step S940, the target device 100 may detect and match the authority information. In more detail, the target device 100 may obtain the authorization information 410 related to the device authorization authenticated through the device certificate 400 from the device certificate 400. Also, the target device 100 may detect the period information 420 from the device certificate 400. In addition, the target device 100 may determine whether to match access policy information based on the permission information previously provided to the target device 100 by considering at least one of the acquired permission information 410 and the period information 420. I can.

In operation S950, the electronic device 200 may decrypt the encrypted first STS code using the private key 810 of the device. In addition, in step S960, the target device 100 may decrypt the encrypted second STS code using the STS key 710. In this case, the STS key 710 may correspond to an STS key previously provided to the target device 100.

In operation S970, the electronic device 200 may transmit the encrypted first STS code to the target device 100.

In this case, as an embodiment not limited in the present disclosure, the first STS code may be encrypted using a long term key (LTK). More specifically, in the present disclosure, the electronic device 200 may decrypt the STS code using the key of the device. Also, the target device 100 may decrypt the STS code using the STS key. However, the conventional system was able to set up a general STS code using a session key-based protocol. Therefore, instead of encrypting the STS code twice in a certificate using different keys, the same operation can be performed with a shared long-term key according to the present disclosure. Using this shared long term key, the electronic device 200 and the target device 100 may derive the same session key and then perform security ranging according to a legacy protocol. However, the method of the electronic device 200 encrypting the first STS code and sending it to the target device 100 is not limited to a method of using a shared long-term key. Methods in which the electronic device 200 transmits the first STS code to the target device 100 may be used in this step so that the target device 100 can match the second STS code with the first STS code. .

In operation S980, the target device 100 may perform secure ranging on the electronic device 200. In more detail, the target device 100 measures the distance between the target device 100 and the electronic device 200, and if the measured distance is less than a preset distance, it checks whether the first STS code and the second STS code match. I can.

In step S990, whether to open or close the door may be determined according to the determination result of the target device 100.

10 corresponds to a diagram showing an embodiment when using a mobile application according to an embodiment of the present disclosure.

According to the present embodiment, the electronic device 200 may receive the device certificate 400 generated from the server 300 through an application executed in the electronic device 200. In this case, the electronic device 200 may include a mobile device application and a payment module.

In addition, the server 300 may include a policy engine and an encryption engine. According to an example of the present disclosure, the server 300 may be implemented as an authorization backend.

First, in step S1010, the electronic device 200 may perform an approval process through a mobile device application driven by the electronic device 200. According to an embodiment of the present disclosure, the electronic device 200 may perform an approval process by receiving login information from a user through a mobile device application.

In addition, in step S1020, the user may input access request information through a mobile device application. In this case, the access request information corresponds to data input by the user, and may include authority information and period information. In addition, as shown in FIG. 10, the authority information may correspond to membership information or the like according to an example of the present disclosure, and authority information according to membership such as VIP or general for the service may be input. In addition, the services provided by the mobile device application are not limited, and may include services provided at a gym, a ski resort, and the like.

In step S1030, the mobile device application may transmit a certificate signing request (CSR), a public key of the electronic device 200, access request information including authority information, and period information to the payment module and the policy engine.

In step S1040, the payment module may generate payment information based on the received access request information. In more detail, the payment module may generate amount information corresponding to the authorization information and period information based on the authorization information and period information input from the user. The user pays the amount by using the payment module implemented in the electronic device, and the payment module generates payment information and transmits the payment information to the policy engine.

In step S1050, the policy engine may check received payment information, information on a certificate signing request (CSR), and policy information stored in the policy engine. In addition, the policy engine may transmit the verified user's data to the encryption engine when it is confirmed.

According to an embodiment of the present disclosure, user access request information such as a period and a membership level may be obtained from a mobile device or a user interface. In this case, when the user's access request information is obtained from the mobile device, the policy engine of the server 300 may check the user's access request information.

The encryption engine may receive verified user data from the policy engine. That is, at this time, the encryption engine may generate a first STS code and a second STS code by verifying the received payment information, information on a certificate signing request (CSR) and policy information stored in the policy engine. In addition, the encryption engine may encrypt the generated first STS code and the second STS code. In addition, the encryption engine may generate the device certificate 400 including the authorization information 410, the period information 420, the encrypted first STS code 430, and the encrypted second STS code 440. Also, the generated device certificate 400 may be signed by the authorization backend.

The device certificate 400 signed in step S1060 may be transmitted to the electronic device. In this case, according to an example of the present disclosure, the signed device certificate 400 may be received in a mobile device application.

FIG. 11 corresponds to a diagram showing an embodiment when using a kiosk according to an embodiment of the present disclosure.

First, in step S1110, the user may input access request information using a keyos. In addition, as described above, the access request information may include authority information and period information, and the authority information may correspond to membership information in a policy providing a corresponding service, and the like.

In step S1120, the payment module may generate payment information based on the received access request information. In more detail, the payment module may generate amount information corresponding to the authorization information and period information based on the authorization information and period information input from the user. The user pays the amount by using the payment module implemented in the kiosk, and the payment module generates payment information and transmits the payment information to the policy engine.

In addition, in step S1130, the electronic device 200 may transmit a certificate signing request (CSR) of the electronic device 200 and a public key of the electronic device to the server through a kiosk. In more detail, the electronic device 200 may transmit a certificate signing request (CSR) and a public key of the electronic device to the policy engine through communication between kiosks. In this case, communication between the electronic device 200 and the kiosk may be performed in a manner different from a communication method used for security ranging. At this time, according to an exemplary embodiment, which is not limited, NFC, BLE, WiFi, LTE, and the like may be used. In addition, the electronic device 200 may be tapped on the kiosk to transmit a certificate signing request (CSR) and a public key.

Implemented in the kiosk in step S1140 The policy engine may check received payment information, information on a certificate signing request (CSR), and policy information stored in the policy engine. In addition, the policy engine may transmit the verified user's data to the encryption engine when it is confirmed.

The encryption engine may receive verified user data from the policy engine. That is, at this time, the encryption engine may generate a first STS code and a second STS code by verifying the received payment information, information on a certificate signing request (CSR) and policy information stored in the policy engine. In addition, the encryption engine may encrypt the generated first STS code and the second STS code. In addition, the encryption engine may generate the device certificate 400 including the authorization information 410, the period information 420, the encrypted first STS code 430, and the encrypted second STS code 440. Also, the generated device certificate 400 may be signed by the authorization backend.

The device certificate 400 signed in step S1150 may be transmitted to the electronic device. In this case, according to an example of the present disclosure, the signed device certificate 400 may be received from the server 300 through a kiosk.

12 corresponds to an example of application to an entrance door of a ski lift according to an embodiment of the present disclosure.

First, according to the present embodiment, the electronic device 200 may correspond to the user's mobile. In addition, the target device 100 may correspond to a device that controls an entrance door of a ski lift. For convenience of explanation, the electronic device 200 will be described as a mobile device and the target device 100 will be described as an entrance door of a ski lift.

The user can input the'ski lift use ticket' (permission information) and period information corresponding to the'ski lift service' at a payment counter (not shown), and pay for the service. In this case, as a non-limiting example of the present disclosure, the payment counter may be implemented as a kiosk. The payment counter may generate a QR code based on the'ski lift use ticket' (permission information) and period information, and present the QR code to the user. The mobile can scan the QR code. Mobile can generate CSR and send CSR to payment counter. The payment counter may authenticate a transaction and issue a device certificate based on the CSR. The device certificate can be applied to all ski-lift entrance gates.

13 is a block diagram illustrating an internal configuration of a target device according to an embodiment of the present disclosure.

Referring to FIG. 13, the target device 100 may include a communication unit 110, a processor 120, and a memory 130. However, the present invention is not limited thereto, and the target device 100 may be implemented by more or less components than all of the components illustrated in FIG. 13.

In FIG. 13, the target device 100 is illustrated as including one processor, but embodiments are not limited thereto, and the target device 100 may include a plurality of processors. At least some of the operations and functions of the processor 120 to be described below may be performed by a plurality of processors. The target device 100 illustrated in FIG. 13 may authenticate the electronic device 200 and perform security ranging using the device certificate 400 based on rights information according to various embodiments of the present disclosure, The description of FIGS. 1 to 12 may be applied. Therefore, the overlapping content as described above will be omitted.

The communication unit 110 may perform short range communication with the electronic device 200. To this end, the communication unit 110 may include a communication module for short-range communication. For example, the communication unit 110 includes a communication module for performing various short-range communication such as infrared communication, magnetic secure transmission (MST), magnetic security communication in addition to Wi-Fi, Wi-Fi Direct, UWB, Bluetooth, and NFC. The communication module may be in the form of a chipset, or may be a sticker/barcode including information necessary for communication (eg, a sticker including an NFC tag).

According to an embodiment of the present disclosure, the memory 130 may install and store various types of data such as programs and files such as applications. The processor 120 may access and use data stored in the memory 130, or may store new data in the memory 130. In one embodiment of the present disclosure, the STS key is registered in the memory 130, the encrypted second STS code is decrypted, the electronic device 200 is authenticated using the device certificate 400, and security ranging is performed. Programs and data for execution can be installed and stored. The processor 120 controls the overall operation of the target device 100 and may include at least one processor such as a CPU or a GPU. The processor 120 may control other components included in the target device 100 to perform an operation for authentication of the electronic device 200. The processor 120 may authenticate the electronic device 200 by authenticating the device certificate 400 based on the authorization information, and control other components included in the target device 100 to perform security ranging.

The processor 120 may execute a program stored in the memory 130 or an external device (not shown), read a stored file, or store a new file.

According to an embodiment, the processor 120 transmits the device certificate 400 including the second STS code encrypted by the STS key and the first STS code encrypted by the public key of the electronic device from the electronic device 200. After receiving and decrypting the encrypted second STS code using the STS key, a second STS code may be obtained, and security ranging with the electronic device 200 may be performed using the second STS code. The processor 120 authenticates the device certificate 400 and detects at least one of authorization information related to the device authorization authenticated through the device certificate based on the device certificate 400 and period information for a period in which the device certificate is valid. can do. In addition, the processor 120 may match at least one of the detected period information and the detected authority information with policy information related to the authority of the electronic device. The processor 120 determines the distance using UWB, It is possible to determine whether to open or close the target device based on the determined distance. In this case, if the target device corresponds to a device that controls the door, the processor 120 may determine a distance using UWB and determine whether to open or close the door based on the determined distance. In addition, when the processor 120 determines whether to open or close the door, when the determined distance is less than a preset distance and the first STS code and the second STS code match, the door may be opened.

14 is a block diagram illustrating an internal configuration of an electronic device according to an embodiment of the present disclosure.

Referring to FIG. 14, the electronic device 200 may include a communication unit 210, a processor 220, and a memory 230. However, the present invention is not limited thereto, and the electronic device 200 may be implemented by more or less than all of the components illustrated in FIG. 14.

In FIG. 14, the electronic device 200 is illustrated as including one processor, but embodiments are not limited thereto, and the electronic device 200 may include a plurality of processors. At least some of the operations and functions of the processor 220 described below may be performed by a plurality of processors. The electronic device 200 illustrated in FIG. 14 may authenticate the electronic device 200 and perform security ranging using the device certificate 400 based on rights information according to various embodiments of the present disclosure, The description of FIGS. 1 to 12 may be applied. Therefore, the overlapping content as described above will be omitted.

The communication unit 210 may perform wired/wireless communication with the server 300 through a network and may perform short-range communication with the target device 100. To this end, the communication unit 210 may include a communication module supporting at least one of various wired and wireless communication methods. For example, the communication module may be in the form of a chipset, or may be a sticker/barcode (e.g. a sticker including an NFC tag) including information necessary for communication.

Wireless communication, for example, may include at least one of cellular communication, wireless fidelity (Wi-Fi), Wi-Fi Direct, Bluetooth, Ultra Wide Band (UWB), or Near Field Communication (NFC). . Wired communication may include, for example, at least one of USB or High Definition Multimedia Interface (HDMI).

In an embodiment, the communication unit 210 may include a communication module for short range communication. For example, the communication unit 210 may include a communication module for performing various short-range communication such as infrared communication, Magnetic Secure Transmission (MST), magnetic security communication in addition to Wi-Fi, Wi-Fi Direct, Bluetooth, and NFC described above. I can.

Various types of data such as programs and files such as applications may be installed and stored in the memory 230. The processor 220 may access and use data stored in the memory 230 or may store new data in the memory 230. In one embodiment, the device private key and the device public key are stored in the memory 230, the encrypted first STS code is decrypted, the electronic device 200 is authenticated using the device certificate 400, and the security lane Programs and data for performing gong can be installed and stored. The processor 220 controls the overall operation of the electronic device 200 and may include at least one processor such as a CPU or a GPU. The processor 220 may control other components included in the electronic device 200 so that the target device 100 and the server 300 may authenticate the device certificate 400 to authenticate the electronic device 200. The processor 220 may control other components included in the electronic device 200.

The processor 220 may execute a program stored in the memory 230, read a stored file, or store a new file.

According to an embodiment, the processor 220 receives, from the server, a device certificate including a first STS code encrypted by the public key of the electronic device 200 and a second STS code encrypted by the STS key, The device certificate is transmitted to the target device, and the encrypted first STS code is decrypted using the private key of the electronic device to obtain the first STS code, and the target device 100 using the first STS code. And security ranging can be performed.

According to an embodiment, when receiving the device certificate 400, the processor 220 sends a certificate signing request (CSR) including authorization information of the electronic device for the target device 100 to the server based on a user input. The device certificate 400 may be transmitted to the 300 and received from the server 300 in response to the certificate signing request. In addition, the processor 220 may include the target device 100 and the ultra-wideband (UWB, Ultra- wideband) can be used to perform security ranging.

Also, the processor 220 may receive the device certificate 400 from the server 300 through an application executed in the electronic device 200.

The processor 220 transmits the certificate signing request (CSR) of the electronic device and the public key of the electronic device to the server 00 through the kiosk, and the processor 220 transmits the device certificate 400 to the server 300 through the kiosk. Can be received from The processor 220 may perform communication between the electronic device 200 and the kiosk in a method different from a communication method used for security ranging.

15 is a block diagram illustrating an internal configuration of a server according to an embodiment of the present disclosure.

Referring to FIG. 15, the server 300 may include a communication unit 310, a processor 320, and a memory 330. However, the present invention is not limited thereto, and the server 300 may be implemented by more or less components than all of the components illustrated in FIG. 15.

In FIG. 15, the server 300 is illustrated as including one processor, but the embodiment is not limited thereto, and may include a plurality of processors. At least some of the operations and functions of the processor 320 to be described below may be performed by a plurality of processors. The server 300 illustrated in FIG. 15 may authenticate the electronic device 200 and perform security ranging using the device certificate 400 based on rights information according to various embodiments of the present disclosure. Descriptions of 1 to 12 may be applied. Therefore, the overlapping content as described above will be omitted.

The communication unit 310 may perform wired or wireless communication with the electronic device 200 through a network. To this end, the communication unit 310 may include a communication module supporting at least one of various wired and wireless communication methods. For example, the communication module may be in the form of a chipset, or may be a sticker/barcode (e.g. a sticker including an NFC tag) including information necessary for communication.

Wireless communication, for example, may include at least one of cellular communication, wireless fidelity (Wi-Fi), Wi-Fi Direct, Bluetooth, Ultra Wide Band (UWB), or Near Field Communication (NFC). . Wired communication may include, for example, at least one of USB or High Definition Multimedia Interface (HDMI).

Various types of data such as programs and files such as applications may be installed and stored in the memory 330. The processor 320 may access and use data stored in the memory 330, or may store new data in the memory 330. In one embodiment, the STS key may be registered in the memory 330, the electronic device 200 is authenticated, the first STS code and the second STS code are generated and encrypted, and the device certificate 400 is generated. The program and data for this can be installed and stored. The processor 320 controls the overall operation of the server 300 and may include at least one processor such as a CPU and a GPU. The processor 320 may control other components included in the server 300 to perform an operation for authenticating the electronic device 200. The processor 320 may control other components included in the server 300 to perform an operation for authenticating the electronic device 200.

The processor 320 may execute a program stored in the memory 330, read a stored file, or store a new file.

According to an embodiment, the processor 320 receives a certificate signing request (CSR) including authorization information of the electronic device for the target device from the electronic device 200, and is associated with a certificate signing request and authorization of the electronic device. Confirms the policy information, and generates a device certificate including the first STS code encrypted by the public key of the electronic device and the second STS code encrypted by the STS key, based on the verification result, and the device certificate 400 May be transmitted to the electronic device 200.

Meanwhile, the above-described embodiment can be written as a program that can be executed on a computer, and can be implemented in a general-purpose digital computer that operates the program using a medium readable by a computer. In addition, the structure of the data used in the above-described embodiment may be recorded on a computer-readable medium through various means. In addition, the above-described embodiments may be implemented in the form of a computer program product including a recording medium including instructions executable by a computer, such as a program module executed by a computer. For example, methods implemented as software modules or algorithms may be stored in a computer-readable recording medium as codes or program instructions that can be read and executed by a computer.

The computer-readable medium may be any recording medium that can be accessed by a computer, and may include volatile and nonvolatile media, and removable and non-removable media. The computer-readable medium includes a magnetic storage medium such as a ROM, a floppy disk, a hard disk, and the like, and may include an optical reading medium such as a CD-ROM, a DVD, etc., but is not limited thereto. . In addition, computer-readable media may include computer storage media and communication media.

In addition, a plurality of computer-readable recording media may be distributed over network-connected computer systems, and data stored in the distributed recording media, for example, program instructions and codes, may be executed by at least one computer. have.

Although the embodiments of the present disclosure have been described with reference to the above and the accompanying drawings, the present disclosure may be implemented in other specific forms without changing the technical spirit or essential features to those of ordinary skill in the art. You can understand that there is. Therefore, it should be understood that the embodiments described above are illustrative and non-limiting in all respects.

Claims (20)

In the method of operating an electronic device,
Receiving from a server a device certificate including a first STS (Scrambled Timestamp Sequence) code encrypted by the public key of the electronic device and a second STS code encrypted by the STS Key;
Transmitting the device certificate to a target device;
Decrypting the encrypted first STS code using the private key of the electronic device to obtain a first STS code; And
And performing security ranging with the target device by using the first STS code.
The method of claim 1,
The device certificate further includes at least one of authorization information related to a device authorization authenticated through the device certificate and period information for a period in which the device certificate is valid.
The method of claim 1
Receiving the device certificate,
Transmitting a certificate signing request (CSR) including authorization information of the electronic device to the target device to the server based on a user input; And
Receiving the device certificate from the server in response to the certificate signing request.
The method of claim 1,
The first STS code and the second STS code are the same STS code.
The method of claim 1
The step of performing security ranging with the target device is performed using an ultra-wideband (UWB).
The method of claim 1
A method of receiving the device certificate from the server through an application running on the electronic device.
The method of claim 1
The electronic device transmits a certificate signing request (CSR) of the electronic device and a public key of the electronic device to the server through a kiosk,
The electronic device receives the device certificate from the server via the kiosk.
According to claim 7
Wherein the communication between the electronic device and the kiosk is different from the communication scheme used for the security ranging.
The method of claim 1,
The device certificate,
The method, wherein the server is signed through an authentication process based on at least one of information on a user's payment information, information on a certificate signing request (CSR), and policy information related to authority of the electronic device.
In the operating method of the target device,
Receiving from the electronic device a device certificate including a second STS (Scrambled Timestamp Sequence) code encrypted by an STS key and a first STS code encrypted by a public key of the electronic device;
Decrypting the encrypted second STS code using the STS key to obtain a second STS code; And
And performing security ranging with the electronic device using the second STS code.
The method of claim 10,
The device certificate further includes at least one of authorization information related to a device authorization authenticated through the device certificate and period information for a period in which the device certificate is valid.
The method of claim 10,
The target device authenticates the device certificate,
And detecting at least one of authorization information related to a device authorization authenticated through the device certificate and period information for a period in which the device certificate is valid based on the device certificate.
The method of claim 12,
And matching policy information related to the authority of the electronic device with at least one of the detected period information and the detected authority information.
The method of claim 10,
The first STS code and the second STS code are the same STS code.
The method of claim 10,
The target device is a device that controls an entrance door,
The performing of the security ranging may include determining a distance using UWB; And
And determining whether to open or close the door based on the determined distance.
The method of claim 15,
The step of determining whether to open or close the entrance door,
The determined distance is less than a preset distance,
If the first STS code and the second STS code match, determining to open the door.
In the server operation method,
Receiving, from the electronic device, a certificate signing request (CSR) including authorization information of the electronic device for the target device;
Checking the certificate signing request and policy information related to the authority of the electronic device;
Generating a device certificate including a first STS code encrypted by the public key of the electronic device and a second STS code encrypted by the STS key based on the verification result; And
Transmitting the device certificate to the electronic device.
The method of claim 17,
The device certificate further includes at least one of authorization information related to a device authorization authenticated through the device certificate and period information for a period in which the device certificate is valid.
In the electronic device,
A communication unit communicating with the server and the target device;
A memory for storing at least one or more instructions; And
At least one processor for controlling the electronic device by executing the at least one or more instructions,
The at least one or more processors,
A device certificate including a first STS code encrypted by the public key of the electronic device and a second STS code encrypted by the STS key is received from the server,
Transmit the device certificate to the target device,
Decrypting the encrypted first STS code using the private key of the electronic device to obtain a first STS code,
An electronic device that performs security ranging with the target device by using the first STS code.
In the target device,
A communication unit that communicates with an electronic device;
A memory for storing at least one or more instructions; And
At least one processor for controlling the target device by executing the at least one or more instructions,
The at least one or more processors,
A device certificate including a second STS code encrypted by the STS key and a first STS code encrypted by the public key of the electronic device is received from the electronic device,
Decrypting the encrypted second STS code using the STS key to obtain a second STS code,
A target device for performing security ranging with the electronic device by using the second STS code.

Images